CVE-2026-55536

### Summary `praisonai/browser/server.py` validates incoming WebSocket connections using a Chrome extension Origin check. The regex `chrome-extension://[a-z0-9]{32}` is applied with `re.match()`, which **only anchors at the start of the string, not the end**. Any Origin header with more than 32 alphanumeric characters after `chrome-extension://` — including non-alphanumeric trailing characters — passes the check. This is a **patch bypass** of GHSA-8x8f-54wf-vv92. That advisory triggered the addition of origin validation; this finding shows the validation is bypassable by any WebSocket client that forges an Origin header. After bypassing, the attacker can send `start_session` commands that are executed by any Chrome extension currently connected to the server — causing the extension to perform arbitrary browser automation including cookie theft and screenshot capture. ### Details **Vulnerable code — `browser/server.py` line 186:** ```python elif parsed_origin.scheme == "chrome-extension" and \ re.match(r"chrome-extension://[a-z0-9]{32}", origin): is_allowed = True ``` `re.match()` returns a match object if the pattern matches at the **beginning** of the string; trailing characters after the 32nd are not evaluated. `re.fullmatch()` (or anchoring with `$`) is required to enforce exact length. **There is no other authentication mechanism** in `_handle_connection()`. Confirmed by source inspection: - No bearer token check - No API key check - No extension ID allowlist - Origin header regex is the only gate before `websocket.accept()` **After connection, `start_session` reaches `_handle_start_session()` (lines 283-414)**, which: 1. Creates a `BrowserAgent` with the attacker-specified `goal` and `model` 2. Broadcasts `start_automation` to every connected Chrome extension 3. The extension then performs the goal on the user's browser ### PoC **Requirements:** PraisonAI browser server running on default `127.0.0.1:8765` **Start the server:** ```bash pyth